@jwilger/pi-development-system 0.20.0 → 0.22.0

package/extensions/development-system.ts

@@ -3,6 +3,7 @@ import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-a
 import { appendContextTail, renderContextTail } from "../src/context/context-tail.ts";
 import { renderStatus, renderStatusLine, STATUS_KEY } from "../src/context/status.ts";
 import { applyPromptSection } from "../src/context/system-prompt.ts";
+import { type Exec, timeoutAsFailure } from "../src/core/exec.ts";
 import { detectProfiles } from "../src/core/profile.ts";
 import { createApprovalStore } from "../src/gates/approvals.ts";
 import { registerCommitGuard } from "../src/gates/commit-guard.ts";
@@ -77,24 +78,26 @@ export function createDevelopmentSystem(pi: ExtensionAPI) {
     return messages === undefined ? undefined : { messages };
   });
 
+  const exec: Exec = async (command, args, options) =>
+    timeoutAsFailure(await pi.exec(command, args, options));
   registerGitGuard({ pi, approvals, jev: (ctx) => jevHolder.forContext(ctx) });
   registerCommitGuard({
     pi,
     state,
     jev: (ctx) => jevHolder.forContext(ctx),
-    exec: (command, args, options) => pi.exec(command, args, options),
+    exec,
   });
   registerCiCommand({
     pi,
     state,
-    exec: (command, args, options) => pi.exec(command, args, options),
+    exec,
   });
   registerPushGuard({
     pi,
     state,
     approvals,
     jev: (ctx) => jevHolder.forContext(ctx),
-    exec: (command, args, options) => pi.exec(command, args, options),
+    exec,
   });
   registerTestGuard({ pi, state, approvals, jev: (ctx) => jevHolder.forContext(ctx) });
   registerTestEvidence({ pi, state });
@@ -107,8 +110,7 @@ export function createDevelopmentSystem(pi: ExtensionAPI) {
   const reviewDeps = {
     state,
     jev: (ctx: ExtensionContext) => jevHolder.forContext(ctx),
-    exec: (command: string, args: string[], options?: { cwd?: string; timeout?: number }) =>
-      pi.exec(command, args, options),
+    exec,
   } satisfies Parameters<typeof createReviewStartTool>[0];
   pi.registerTool(createReviewStartTool(reviewDeps));
   pi.registerTool(createReviewRecordTool(reviewDeps));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jwilger/pi-development-system",
-  "version": "0.20.0",
+  "version": "0.22.0",
   "description": "A pi extension package representing a seasoned approach to software development using a full AI SDLC.",
   "keywords": [
     "pi-package"

package/skills/code-review/SKILL.md

@@ -50,8 +50,8 @@ The verdict must agree with the findings.
 - **false-positive**: refuted; ignored.
 
 Jev may raise a finding's severity when it is at least 0.8 confident; it never
-lowers a blocking or should-fix finding (it only suggests, in the reply, and you
-re-check it yourself). A round is clean when it has no blocking or should-fix findings.
+lowers a finding to a severity that does not count (it only suggests, in the
+reply, and you re-check it yourself). A round is clean when it has no blocking or should-fix findings.
 The default is three consecutive clean rounds (`review.required_clean_rounds`).
 Only real findings reset the count; a changed diff alone does not, so a small fix
 commit keeps the clean rounds already earned unless findings come back.

package/src/core/exec.ts

@@ -4,3 +4,24 @@ export type Exec = (
   args: string[],
   options?: { cwd?: string; timeout?: number },
 ) => Promise<{ code: number; stdout: string; stderr: string }>;
+
+/** Exit code reported for a command that was killed for running too long (as `timeout(1)` does). */
+export const TIMEOUT_CODE = 124;
+
+/**
+ * pi reports a killed command as `code: 0, killed: true`, so a timed-out `git diff` would look like an
+ * empty diff. A guard must never read that as "nothing changed": make the kill a failure.
+ */
+export const timeoutAsFailure = (result: {
+  code: number;
+  stdout: string;
+  stderr: string;
+  killed?: boolean;
+}): { code: number; stdout: string; stderr: string } =>
+  result.killed === true
+    ? {
+        code: TIMEOUT_CODE,
+        stdout: result.stdout,
+        stderr: `${result.stderr}\ntimed out`.trim(),
+      }
+    : { code: result.code, stdout: result.stdout, stderr: result.stderr };

package/src/core/review-flow.ts

@@ -56,6 +56,12 @@ export function reviewGap(state: DevsysState, slice: SliceRef, now: DiffNow): st
   }
 }
 
+const ESCAPES: Record<string, string> = { t: "\t", n: "\n", '"': '"', "\\": "\\" };
+
+/** Undo git's C-style quoting of a path (`\"`, `\\`, `\t`, `\n`; octal bytes were already turned off with quotePath=false). */
+const unquote = (path: string): string =>
+  path.replace(/\\([tn"\\])/g, (_m, c: string) => ESCAPES[c] ?? c);
+
 /** A unified diff cut into one text per file, keyed by the file's new path. */
 export function splitDiffByFile(diff: string): Record<string, string> {
   const out: Record<string, string> = {};
@@ -69,7 +75,7 @@ export function splitDiffByFile(diff: string): Record<string, string> {
     const header = /^diff --git "?a\/.*?"? "?b\/(.*?)"?$/.exec(line);
     if (header !== null) {
       flush();
-      path = header[1] ?? line;
+      path = unquote(header[1] ?? line);
       lines = [];
     }
     lines.push(line);

package/src/gates/commit-guard.ts

@@ -13,6 +13,7 @@ import {
   parseConventionalCommit,
 } from "../core/commit-message.ts";
 import type { Exec } from "../core/exec.ts";
+import { resolveGit } from "../core/git-invocations.ts";
 import { reviewGap } from "../core/review-flow.ts";
 import { type GateId, isParseError, parseGateId } from "../core/types.ts";
 import type { Jev } from "../jev/client.ts";
@@ -119,7 +120,11 @@ async function jevNeeds(
 }
 
 /** While work is in flight, committing needs the slice review satisfied on the diff as it is now. */
-async function reviewNeeds(deps: CommitGuardDeps, ctx: ExtensionContext): Promise<Need[]> {
+async function reviewNeeds(
+  deps: CommitGuardDeps,
+  ctx: ExtensionContext,
+  command: string,
+): Promise<Need[]> {
   const { phase, activeSlice } = deps.state.get();
   if ((phase !== "implementing" && phase !== "reviewing") || activeSlice === undefined) return [];
   const snap = await snapshotDiff(deps.exec, ctx.cwd, "HEAD");
@@ -129,7 +134,69 @@ async function reviewNeeds(deps: CommitGuardDeps, ctx: ExtensionContext): Promis
     activeSlice,
     snap.ok ? { digest: snap.value.digest, files: snap.value.files } : { digest: "unknown" },
   );
-  return gap === undefined ? [] : [{ gate: REVIEW, why: gap }];
+  if (gap !== undefined) return [{ gate: REVIEW, why: gap }];
+  // The review saw the work tree; a plain `git commit` records the index. A file staged and then edited
+  // again would commit the older, unreviewed content.
+  const stale = stagedThenEdited(await changedNames(deps.exec, ctx.cwd), command);
+  return stale.length === 0
+    ? []
+    : [
+        {
+          gate: REVIEW,
+          why: `the staged content of ${stale.join(", ")} differs from the work tree that was reviewed (edited after \`git add\`); stage it again`,
+        },
+      ];
+}
+
+/** Files staged and also changed since staging; empty when the commit stages everything itself. */
+const stagedThenEdited = (
+  names: { staged: readonly string[]; unstaged: readonly string[] } | undefined,
+  command: string,
+): string[] =>
+  names === undefined || stagesAllTracked(command)
+    ? []
+    : // A path named in the command is committed (or re-staged) from the work tree, which was reviewed.
+      names.staged.filter((name) => names.unstaged.includes(name) && !command.includes(name));
+
+const STAGE_ALL = new Set(["-A", "--all", "-u", "--update", "."]);
+
+/** The command re-stages every tracked change itself: `commit -a`, or `git add -A|-u|.`. Read from parsed invocations, not message text. */
+function stagesAllTracked(command: string): boolean {
+  return resolveGit(command).invocations.some(
+    (i) =>
+      (i.sub === "commit" &&
+        i.args.some(
+          (a) =>
+            a === "--all" || a === "--include" || (/^-[a-zA-Z]{1,4}$/.test(a) && a.includes("a")),
+        )) ||
+      (i.sub === "add" && i.args.some((a) => STAGE_ALL.has(a))),
+  );
+}
+
+async function changedNames(
+  exec: Exec,
+  cwd: string,
+): Promise<{ staged: string[]; unstaged: string[] } | undefined> {
+  try {
+    const base = [
+      "-c",
+      "core.quotePath=false",
+      "diff",
+      "--no-ext-diff",
+      "--name-only",
+      "-z",
+      "--ignore-submodules=dirty",
+    ];
+    const [staged, unstaged] = await Promise.all([
+      exec("git", [...base, "--cached"], { cwd, timeout: 10_000 }),
+      exec("git", base, { cwd, timeout: 10_000 }),
+    ]);
+    if (staged.code !== 0 || unstaged.code !== 0) return undefined;
+    const split = (text: string) => text.split("\0").filter((n) => n !== "");
+    return { staged: split(staged.stdout), unstaged: split(unstaged.stdout) };
+  } catch {
+    return undefined;
+  }
 }
 
 const reviewReason = (need: Need): string =>
@@ -187,7 +254,7 @@ export function registerCommitGuard(deps: CommitGuardDeps): void {
     if (forbidden.length > 0) return { block: true, reason: forbiddenReason(forbidden) };
 
     const known = messages.flatMap((m) => (m === undefined ? [] : [m]));
-    const all: Need[] = await reviewNeeds(deps, ctx);
+    const all: Need[] = await reviewNeeds(deps, ctx, command);
     // A -F file that cannot be read now (written by this same command, or stdin) cannot be checked.
     if (extractions.some((e, i) => e.kind === "file" && messages[i] === undefined)) {
       all.push({

package/src/review/digest.ts

@@ -1,4 +1,6 @@
 import { createHash } from "node:crypto";
+import { lstat, readlink } from "node:fs/promises";
+import { join } from "node:path";
 import type { Exec } from "../core/exec.ts";
 import { err, ok, type Result } from "../core/result.ts";
 import { splitDiffByFile } from "../core/review-flow.ts";
@@ -35,13 +37,18 @@ export async function snapshotDiff(
     const [diff, stat, others] = await Promise.all([
       exec("git", [...plain, "--full-index", "--no-renames", range], { cwd, timeout: 15_000 }),
       exec("git", [...plain, "--stat", range], { cwd, timeout: 15_000 }),
-      range === "HEAD"
-        ? exec("git", ["ls-files", "--others", "--exclude-standard"], { cwd, timeout: 15_000 })
+      // Any range that ends in the work tree (HEAD, HEAD~1, a branch) leaves untracked files out of git diff.
+      !range.includes("..")
+        ? exec(
+            "git",
+            ["-c", "core.quotePath=false", "ls-files", "-z", "--others", "--exclude-standard"],
+            { cwd, timeout: 15_000 },
+          )
         : Promise.resolve({ code: 0, stdout: "", stderr: "" }),
     ]);
     if (diff.code !== 0) return err(diff.stderr.trim() || `git diff ${range} failed`);
     if (others.code !== 0) return err(others.stderr.trim() || "git ls-files --others failed");
-    const listed = others.stdout.split("\n").filter((p) => p !== "");
+    const listed = others.stdout.split("\0").filter((p) => p !== "");
     // A nested repository is listed as `dir/` and has no blob to hash.
     const nested = listed.filter((p) => p.endsWith("/"));
     const untracked = listed.filter((p) => !p.endsWith("/"));
@@ -58,15 +65,27 @@ export async function snapshotDiff(
       return err("could not read the diff: no per-file sections were found");
     }
     if (untracked.length > 0) {
-      const hashes = await exec("git", ["hash-object", "--", ...untracked], {
-        cwd,
-        timeout: 15_000,
-      });
-      const lines = hashes.stdout.split("\n").filter((l) => l !== "");
-      if (hashes.code !== 0 || lines.length !== untracked.length) {
-        return err(hashes.stderr.trim() || "git hash-object could not hash every untracked file");
+      const links = new Set<string>();
+      for (const path of untracked) {
+        const target = await linkTarget(cwd, path);
+        if (target !== undefined) {
+          files[path] = `new:${blobOf(target)}`;
+          links.add(path);
+        }
+      }
+      // `git hash-object <path>` follows symlinks (and fails on dangling ones), so links are hashed above.
+      const regular = untracked.filter((p) => !links.has(p));
+      if (regular.length > 0) {
+        const hashes = await exec("git", ["hash-object", "--", ...regular], {
+          cwd,
+          timeout: 15_000,
+        });
+        const lines = hashes.stdout.split("\n").filter((l) => l !== "");
+        if (hashes.code !== 0 || lines.length !== regular.length) {
+          return err(hashes.stderr.trim() || "git hash-object could not hash every untracked file");
+        }
+        for (const [i, path] of regular.entries()) files[path] = `new:${lines[i]}`;
       }
-      for (const [i, path] of untracked.entries()) files[path] = `new:${lines[i]}`;
     }
     const names = Object.keys(files).sort();
     const untrackedStat = [
@@ -91,3 +110,20 @@ const fileDigest = (section: string): string => {
   const blob = NEW_FILE.exec(section)?.[1];
   return blob === undefined ? digestOf(section) : `new:${blob}`;
 };
+
+/** The text of a symlink, or undefined when `path` is not one (or cannot be inspected). */
+async function linkTarget(cwd: string, path: string): Promise<string | undefined> {
+  try {
+    const full = join(cwd, path);
+    return (await lstat(full)).isSymbolicLink() ? await readlink(full) : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/** Git's blob id for some content: what `git add` stores for a symlink is its target text. */
+const blobOf = (content: string): string =>
+  createHash("sha1")
+    .update(`blob ${Buffer.byteLength(content)}\0`)
+    .update(content)
+    .digest("hex");